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Qualys bridges asset and 
vulnerability management with 
free asset inventory offering 
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By Patrick Daly 


The company announced that it would offer its asset inventory cloud application free of charge, a 
development likely to affect the broader IT asset management market. The move is also likely to ruffle 
the feathers of emerging asset management players that aggregate information from an organization’s 
existing IT and security resources. 
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Introduction 


Just ahead of this year’s Black Hat conference, Qualys revealed that it was making its Asset Inventory 
(Al) application free for all of its customers. The change promises to shake up an IT asset management 
market already undergoing rapid transformation thanks to the growing heterogeneity of IT assets 

and computing environments complicating enterprise efforts to gain visibility and control over all of 
their assets. 


451 TAKE 


While Qualys Al has been in this sector of the market for a little over a year, the decision 
to offer it for free is a shrewd move that reflects a heightened enterprise need for 
visibility and control across increasingly diverse IT environments. Since the company 
generates most of its revenue from its vulnerability scanning, reporting and compliance- 
related applications, it should easily absorb the Al application’s operating cost. The 
move is also likely to ruffle the feathers of emerging asset management players that 
aggregate information and functionality from an organization’s existing IT and security 
resources. The value proposition of providing enterprises with similar functionality 
without the complexity inherent in managing multiple connectors to distinct products 
should help to strengthen Qualys’ position against these vendors. 


Details 


Qualys Al uses a combination of authenticated, unauthenticated and passive scans to continuously 
discover, normalize, classify and categorize an enterprise’s assets in real time. The company claims 
that Al can discover all an organization’s managed and unmanaged devices (including non-standard loT 
devices), on-premises or cloud assets, containers and operational technology. 


Offering this functionality as a free service has the potential to create several benefits for both 
Qualys and its customers. For the end customer, Qualys Al acts as a logical extension of the 
company’s existing capabilities, integrating the real-time inventory into the company’s vulnerability 
scanning, patch management and compliance applications for a more fluid vulnerability and 
exposure management process. For Qualys, the move has the potential to unlock new revenue while 
simultaneously strengthening its competitive position. Qualys agents can be installed on recently 
discovered assets directly through the platform, bringing the full functionality of Qualys’ cloud 
applications with them. Since the company prices its products on a per-application, per-device basis, 
Qualys Al offers a simple path for organic growth within existing customer deployments. 


Competitively, the move may help bolster Qualys’ position against vulnerability management vendors 
like Rapid7 and Tenable by expanding the scope of the platform and offering a single Ul through 

which security practitioners can view assets, conduct scans and manage remediation workflows. It’s 
also a shot across the bow of emerging IT asset management vendors, such as Axonius, Panaseer 

and LifeOmic’s JupiterOne. The majority of these vendors act as aggregators, connecting with an 
organization’s existing IT and security tools (including Qualys) to consolidate asset data, vulnerabilities 
and workflow automation tools for remediation into a single dashboard. Qualys’ ability to provide 
similar functionality with a simpler deployment model could reduce the marginal value of deploying 
other asset management tools when an organization already has Qualys agents installed. 
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